Free tool
Chmod calculator
| Read (4) | Write (2) | Execute (1) | Digit | |
|---|---|---|---|---|
| Owner | 7 | |||
| Group | 5 | |||
| Others | 5 |
Owner can read, write and run; group and others can read and run.
On a directory, “run” means enter it and reach the files inside.
Set it on a file
chmod 755 fileSet it on a folder and everything in it
chmod -R 755 dirSame thing, symbolic
chmod u=rwx,g=rx,o=rx fileHow chmod numbers work
Every file has three sets of permissions: for its owner, for its group and for others (everyone else). Each set is read, write and execute.
In the number, each digit is one set, in the order owner, group, others. Add up r = 4, w = 2, x = 1: 7 is rwx, 6 is rw-, 5 is r-x, 4 is r--, 0 is nothing. So 755 means owner 7 (rwx), group 5 (r-x), others 5 (r-x), which ls -l prints as rwxr-xr-x.
On a directory the letters mean slightly different things: read lists the names inside, write creates, renames and deletes files in it, and execute lets you enter it and reach the files inside. A fourth digit in front (like the 2 in 2775) sets the special bits, explained below.
Common chmod modes
| Mode | Symbolic | Who can do what | Typical use |
|---|---|---|---|
| 777 | rwxrwxrwx | Everyone can read, write and run. | Almost never right. Anyone on the machine can change or replace it. |
| 775 | rwxrwxr-x | Owner and group can read, write and run; others can read and run. | Shared project folders where a team group edits files. |
| 770 | rwxrwx--- | Owner and group can read, write and run; others have no access. | A team folder that people outside the group should not see. |
| 755 | rwxr-xr-x | Owner can read, write and run; group and others can read and run. | Directories, scripts and programs. The usual mode for folders on a web server. |
| 750 | rwxr-x--- | Owner can read, write and run; group can read and run; others have no access. | An app folder only its owner and one group (say, the web server group) may enter. |
| 700 | rwx------ | Owner can read, write and run; group and others have no access. | ~/.ssh and other private folders or scripts. |
| 666 | rw-rw-rw- | Everyone can read and write. | Rarely right for real files. /dev/null is 666. |
| 664 | rw-rw-r-- | Owner and group can read and write; others can read. | Files a team group edits together. |
| 644 | rw-r--r-- | Owner can read and write; group and others can read. | Web files (HTML, CSS, images), most config files, public keys like id_ed25519.pub. |
| 640 | rw-r----- | Owner can read and write; group can read; others have no access. | Config with secrets that one service group needs to read. |
| 600 | rw------- | Owner can read and write; group and others have no access. | Private keys (~/.ssh/id_ed25519), ~/.ssh/config, .env files. |
| 444 | r--r--r-- | Everyone can read. | Read-only for everyone. The owner can still chmod it back. |
| 400 | r-------- | Owner can read; group and others have no access. | Read-only, owner only. AWS tells you to chmod 400 your .pem key. |
The modes people look up most
chmod 777 rwxrwxrwx
Owner, group and everyone else can read, write and run it. On a directory, anyone can create, rename and delete files in it. That is why 777 is risky: any account on the server, and any process running as another user (a compromised web app, a cron job), can change your code, plant a script or delete your data.
People reach for 777 when a web server "can't write" to a folder. The real fix is ownership: chown -R www-data:www-data uploads (or add the server user to the folder's group) and keep the folder at 755 or 775. A shared, world-writable folder like /tmp should be 1777, with the sticky bit.
chmod 755 rwxr-xr-x
The owner can read, write and run; group and others can read and run. It is what new directories get with the common umask 022, and the right mode for scripts and programs that others may run. On a directory, the x bit is what lets people enter it and open the files inside, so web folders need it.
chmod 644 rw-r--r--
The owner can read and write; everyone else can only read. Nobody can run it. Most regular files are 644: HTML, CSS, images, config files and public keys. A web server running as another user can serve a 644 file because others have read.
chmod 600 rw-------
Only the owner can read and write; nobody else can do anything. Use it for secrets: SSH private keys, ~/.ssh/config, .env files, API tokens. ssh refuses a private key that group or others have any access to, so chmod 600 ~/.ssh/id_ed25519 is the usual fix for "UNPROTECTED PRIVATE KEY FILE".
chmod 700 rwx------
Only the owner can read, write and run (or enter, for a directory). Group and others have no access. The OpenSSH docs recommend it for ~/.ssh: read, write and execute for you, nothing for anyone else. It is also a good mode for private scripts.
chmod 775 rwxrwxr-x
Owner and group can read, write and run; others can read and run. Use it for folders a team shares through a Unix group, where everyone in the group adds and edits files. Pair it with the setgid bit (2775) so new files get the folder's group.
Chmod recursively
-R applies the mode to a directory and everything inside it. chmod skips symbolic links it finds inside the tree.
chmod -R 755 dir
The catch: that makes every file executable too. To give folders 755 and files 644, set them separately with find:
find dir -type d -exec chmod 755 {} +
find dir -type f -exec chmod 644 {} +Or let chmod do it in one go with a capital X, which adds execute only to directories and to files that already had execute for someone:
chmod -R u=rwX,go=rX dir # folders 755, files 644, executables stay 755 chmod -R u+rwX,go+rX dir # same idea, but only adds: it never removes a permission
Run it on the folder you mean. chmod -R on the wrong path (or on /) can break a system; GNU chmod has --preserve-root to refuse the root directory.
Symbolic mode: u+x, g-w, o=r
Instead of a number, chmod takes who, an operator and permissions. Who is u (owner), g (group), o (others) or a (all three). The operator is + (add), - (remove) or = (set exactly). A number always sets all bits; symbolic mode can change one and leave the rest.
chmod u+x deploy.sh # owner may run it chmod g-w notes.txt # group may no longer write chmod o=r report.pdf # others: read only, nothing else chmod a+x tool # everyone may run it chmod go-rwx secrets.env # group and others lose all access chmod u=rw,go=r file # the same as chmod 644 file
chmod +x script.sh, with no who, adds execute for everyone except what your umask blocks. With the common umask 022 that is owner, group and others. After it you can run ./script.sh.
Special bits: setuid, setgid, sticky
A fourth digit in front of the usual three adds special bits: 4 is setuid, 2 is setgid, 1 is sticky. They add up like the others, so 6755 is setuid plus setgid.
- setuid (4xxx): a program runs with its owner's user ID, not yours.
/usr/bin/passwdis setuid root so you can change your own password. Linux ignores setuid on shell scripts. - setgid (2xxx): a program runs with the file's group. On a directory, new files inside get the directory's group, which is why
chmod 2775 shared/is common for team folders. - sticky (1xxx): on a directory, only a file's owner, the directory's owner or root can delete or rename files in it.
/tmpis 1777: everyone can write there, but nobody can delete other people's files.
ls -l shows them in the execute slot: s for setuid (owner) and setgid (group), t for sticky (others). Lowercase means execute is also set; uppercase S or T means it is not, which is usually a mistake. So 4755 is rwsr-xr-x, 4644 is rwSr--r-- and 1777 is rwxrwxrwt.
In symbolic mode they are u+s, g+s and +t. One GNU quirk: chmod 755 dir keeps a directory's existing setgid bit. To clear it use chmod g-s dir.
Umask, and macOS
umask decides the mode of new files. Most programs create files as 666 and directories as 777, and the umask removes bits from that. The common umask 022 gives 644 files and 755 folders; 077 gives 600 and 700. Run umask to see yours.
macOS ships the BSD chmod, not GNU. Numbers, symbolic modes and -R work the same, but GNU-only long options like --reference and --preserve-root are missing. ls -l on a Mac may print @ (extended attributes) or + (an ACL) after the mode.
More: CLI tools on DevHunt · security tools · all free developer tools · GNU chmod manual
FAQ
What does chmod do?+
chmod (change mode) sets who may read, write and execute a file or directory on Linux, macOS and other Unix systems. Each file has three sets of permissions: for its owner, for its group and for everyone else. Only the file owner or root can change them.
What does chmod 777 mean, and is it safe?+
chmod 777 gives read, write and execute permission to the owner, the group and every other user (rwxrwxrwx). It is rarely safe: any user or process on the machine, including a hacked web app, can change or replace the file, and on a directory anyone can add or delete files. Fix the owner (chown) or the group instead, then use 755 or 775.
What is the difference between chmod 755 and 644?+
755 (rwxr-xr-x) lets everyone read and execute, and only the owner write. 644 (rw-r--r--) lets everyone read and only the owner write, and nobody can execute. Use 755 for directories and scripts, 644 for ordinary files.
How do I chmod recursively?+
chmod -R 755 dir changes dir and everything inside it. That also makes every file executable, so it is usually better to set directories and files separately: find dir -type d -exec chmod 755 {} + and find dir -type f -exec chmod 644 {} +. Or use chmod -R u=rwX,go=rX dir, where capital X adds execute only to directories and files that were already executable.
What does chmod +x do?+
chmod +x file adds execute permission so you can run it as ./file. With no u, g, o or a in front, chmod adds it for everyone except the bits your umask blocks; with the common umask 022 that means owner, group and others. Use chmod u+x file to add it for the owner only.
What permissions should SSH keys have?+
The private key (~/.ssh/id_ed25519 or id_rsa) should be 600 or 400, the ~/.ssh folder 700, and public keys 644. ssh refuses to use a private key that group or others have any access to, and prints UNPROTECTED PRIVATE KEY FILE.
What do s and t mean in ls -l output?+
s in the owner or group execute slot is the setuid or setgid bit; t in the others slot is the sticky bit. Lowercase means the execute bit is also set, uppercase S or T means it is not. For example /tmp shows drwxrwxrwt, which is mode 1777.